Enterprise Server 3.15 est actuellement disponible en tant que version finale (RC).

Requêtes C# pour l’analyse CodeQL

Explorez les requêtes que CodeQL utilise pour analyser le code écrit en C# et ce lorsque vous sélectionnez la suite de requêtes default ou security-extended.

Qui peut utiliser cette fonctionnalité ?

CodeQL est disponible pour les types de référentiels suivants :

CodeQL includes many queries for analyzing C# code. All queries in the default query suite are run by default. If you choose to use the security-extended query suite, additional queries are run. For more information, see "CodeQL query suites."

Built-in queries for C# analysis

This table lists the queries available with the latest release of the CodeQL action and CodeQL CLI. For more information, see CodeQL change logs in the CodeQL documentation site.

Note

The initial release of GitHub Enterprise Server 3.15 included CodeQL action and CodeQL CLI 2.18.4, which may not include all of these queries. Your site administrator can update your CodeQL version to a newer release. For more information, see "Configuring code scanning for your appliance."

Query nameRelated CWEsDefaultExtendedCopilot Autofix
'requireSSL' attribute is not set to true319, 614
Arbitrary file access during archive extraction ("Zip Slip")022
ASP.NET config file enables directory browsing548
Assembly path injection114
Clear text storage of sensitive information312, 315, 359
Cookie security: overly broad domain287
Cookie security: overly broad path287
Cookie security: persistent cookie539
Creating an ASP.NET debug binary may reveal sensitive information11, 532
Cross-site scripting079, 116
Denial of Service from comparison of user input against expensive regex1333, 730, 400
Deserialization of untrusted data502
Deserialized delegate502
Encryption using ECB327
Exposure of private information359
Failure to abandon session384
Header checking disabled113
Improper control of generation of code094, 095, 096
Information exposure through an exception209, 497
Information exposure through transmitted data201
Insecure randomness338
LDAP query built from user-controlled sources090
Log entries created from user input117
Missing cross-site request forgery token validation352
Missing global error handler12, 248
Missing X-Frame-Options HTTP header451, 829
Page request validation is disabled16
Regular expression injection730, 400
Resource injection099
SQL query built from user-controlled sources089
Uncontrolled command line078, 088
Uncontrolled data used in path expression022, 023, 036, 073, 099
Uncontrolled format string134
Untrusted XML is read insecurely611, 827, 776
Unvalidated local pointer arithmetic119, 120, 122, 788
URL redirection from remote source601
User-controlled bypass of sensitive method807, 247, 350
Weak encryption327
Weak encryption: inadequate RSA padding327, 780
Weak encryption: Insufficient key size326
XML injection091
XPath injection643
Empty password in configuration file258, 862
Hard-coded connection string with credentials259, 321, 798
Hard-coded credentials259, 321, 798
Insecure Direct Object Reference639
Insecure SQL connection327
Missing function level access control285, 284, 862
Missing XML validation112
Password in configuration file13, 256, 313
Serialization check bypass20
Thread-unsafe capturing of an ICryptoTransform object362
Thread-unsafe use of a static ICryptoTransform field362
Use of file upload434
Value shadowing348
Value shadowing: server variable348